Privacy notice
Last updated: 14 October 2026
The German version is the legally binding version.
This notice applies to the website and web app. The native iOS app has an additional, dedicated app privacy notice.
1. Controller and privacy contact
The controller for CircleRecs is Axel Springer Deutschland GmbH, Axel-Springer-Straße 65, 10888 Berlin, Germany, telephone +49 30 2591 0. For product questions, contact support@circlerecs.com.
You can contact the data protection officer at Axel Springer Deutschland GmbH, Datenschutz, Axel-Springer-Straße 65, 10888 Berlin, or by email at datenschutz@axelspringer.com.
2. Website access and necessary browser storage
When you access the website and API, our hosting and security services process information such as your IP address, timestamp, requested URL, referrer, HTTP headers, browser and device information, response status, and error details. This is necessary to deliver the app, fix errors, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Technical logs are generally deleted after 30 days.
On our own website, CircleRecs uses no advertising cookies and no third-party user tracking; for affiliate and booking links to partners and the redirect involved, see section 8. We only store information required for features you request: your language choice in a cookie for up to one year, sign-in and session information in session storage, your last selected circle in local storage, and a map position you choose to share in session storage. Access to this browser storage is based on Section 25(2) TDDDG. We do not show a cookie banner while we use only this necessary storage.
3. Waitlist, account, and social features
For the waitlist, we process your email address, language, signup source and time, delivery status, and waitlist status. We do this on the basis of your consent under Art. 6(1)(a) GDPR. You may withdraw it for the future at any time by contacting support@circlerecs.com.
When you sign in with Google or Apple, we receive the relevant account identifier and the basic information you release, such as email address, name, and profile image. In the app, we also process your profile and visibility settings, links you voluntarily add to your social profiles, circles, roles, invitations, chats, reactions, notification preferences, follows and blocks, recommendations, personal Want and Pass places, photos, Ask conversations, and reports. This is necessary to provide CircleRecs under Art. 6(1)(b) GDPR. We rely on Art. 6(1)(f) GDPR for security, misuse prevention, and technically necessary product improvement.
When email access is enabled, you can use a confirmed email address and password; self-registration requires a separate rollout. The sign-in forms send passwords and codes directly to Amazon Cognito, not to the CircleRecs product API or analytics. Amazon SES sends invitations, confirmation and recovery codes. A project-specific AWS Lambda function formats emails in the selected language without logging codes. The language of each action is used for delivery; during registration it is also saved as a language preference in the Cognito account. Passwords and codes are not stored in the product database. The email address is used for sign-in, security and recovery, not automatically for marketing. Existing account-deletion rules also apply to these accounts.
If you enable push notifications in the iOS app, we store a random installation identifier, the APNs device token issued by Apple, the development or production environment, bundle and app version, and optionally your language and time zone. We use this only to deliver and troubleshoot your Circle notifications. The app attempts to remove the registration when you sign out, and it is deleted with your account. Apple processes the data needed for delivery under its own terms.
CircleRecs is intended only for people aged 18 or older. You confirm the minimum age independently of the optional age field. If you provide your age, we derive and store your birth year for age-range filters you choose. Other users do not receive your exact birth year, but may receive a coarse age range derived from it. You can remove this information from your profile at any time; it is deleted no later than with your account. The legal basis is performance of the user contract under Art. 6(1)(b) GDPR.
Content in private circles is visible to their active members. If you make your profile public, your public profile, recommendations intended for that profile, and social-profile links you voluntarily add may also be visible outside your circles and without sign-in. For private profiles, signed-in users may still see the display name, username, profile photo, and aggregate counts; recommendations, places, bio, taste tags, social links, and the follower/following lists remain hidden. Private profiles are not shown in the ranked creator feed; signed-in users must explicitly enable the separate private-profile view and may then filter it by name or username. Following a private profile does not unlock this content. Profile owners can remove followers or block accounts. Private profile areas, private places, chats, blocks, and import previews are not displayed publicly.
If you join an Exclusive Circle through the iOS app, Apple independently processes the purchase and payment data. CircleRecs does not receive card or bank details. We process a random identifier linking the purchase to your app account, the Apple product identifier, original and latest transaction identifiers, sandbox or production environment, purchase and expiry times, and subscription, renewal, grace-period, refund, and revocation status. This is necessary to verify and restore the purchase, provide access, prevent duplicate assignment and misuse, and handle support, refunds, and reconciliation. The legal basis is Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR for misuse prevention and legal claims, and Art. 6(1)(c) GDPR for legally required accounting records.
For approved creators, we additionally process approval and account status, the assigned Apple product and Exclusive Circle, agreed revenue share, payout currency and threshold, and proceeds, refund, adjustment, and payout entries. Necessary contract, invoice, tax, and bank details are handled only through authorised finance and contracting processes and are not displayed publicly. The legal bases are Art. 6(1)(b) and (c) GDPR.
4. Location and voice input
The map requests your location only after you actively allow it in the browser or operating system. The position is used on your device to position the map. If you explicitly choose “Use location” in Discover creators, CircleRecs uses the current coordinate once to determine the city used by the creator filter. With “Current city”, this may also happen automatically with previously granted permission, as described under “Private cities for creator suggestions”. If you then use Ask for nearby recommendations, the visible map centre is processed with your question. We use this context only for the current request and do not store it as a location history. You can withdraw permission at any time in your browser or iOS settings, or move the map to a different area before using Ask.
The web app renders maps with the locally embedded open-source library MapLibre GL. It retrieves the map style and map tiles directly from OpenFreeMap. OpenFreeMap therefore receives technically necessary request data such as your IP address, browser and device information, and the requested map areas. For place searches, the Nominatim service on openstreetmap.org and, where needed, Geoapify may receive the search term, location context, language, and an optional country hint. Place data includes contributions from OpenStreetMap and the Overture Maps Foundation; queries and user data are not sent to Overture. The iOS app displays maps with Apple MapKit, uses it to offer address suggestions, and can open places in Apple Maps. Apple may process the technically necessary map and address-search requests, including the entered search term, and, if you grant location access, location data under its own privacy terms.
Voice input, for example in Ask or when writing a recommendation note, uses your browser's speech-recognition service or Apple Speech in the iOS app. The provider may process audio under its own terms; where the device supports it, the iOS app requests on-device recognition as well. If you enable additional audio processing, CircleRecs securely sends the short recording to OpenAI so names and places can be transcribed more reliably. Before the first processing, we ask for your consent under Art. 6(1)(a) GDPR. You may withdraw it for the future. CircleRecs does not retain the raw recording; temporary files are discarded after the request. The transcript and any content you save from it are processed like other product data. Voice is optional and you can always type instead.
5. AI and semantic search
OpenAI converts recommendation text and relevant location context into numerical representations called embeddings. Pinecone processes these representations and limited search metadata for semantic search. Depending on the scope you select, only your own content and circle, follow, or public content you are allowed to access is considered. CircleRecs continues to enforce the access rights that apply to each item.
Ask and AI-assisted place capture use an AI system. When you use these features, you are interacting with an AI system rather than a person. Answers and editable suggestions are created automatically from your input, recent conversation context where relevant, and matching sources, and are not editorially reviewed before you see them. The original recommendations remain visible as sources. When you add or import places, we may generate category and taste suggestions from publicly available place context (for example OpenStreetMap attributes); you can review and change them before saving. AI output may be incomplete or wrong. CircleRecs does not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
If the detected language of a personal recommendation note visible to you differs from your selected app language, CircleRecs may use OpenAI to create a display translation. The original remains unchanged and can always be shown. Translations are refreshed when the original changes and deleted with the recommendation or account. They do not alter search, filters, Ask, or the editable original note.
When you start AI-assisted place search, the query, language, region, and the place or map context you selected may be sent to OpenAI. OpenAI may search publicly available web sources to suggest a venue identity, address, and—where reliably found on the official website of that exact venue—opening hours. CircleRecs does not accept AI-suggested coordinates without verification against our place catalogue and geocoding services. Suggestions may be wrong or outdated and can be reviewed before saving. Technical search hints may be cached for up to six hours to reduce repeated calls to external services.
We use OpenAI as a processor acting on our instructions solely to provide the CircleRecs features you request. The legal basis is Art. 6(1)(b) GDPR. Content processed through the API is not used for advertising or to train general-purpose AI models. A separate general AI consent toggle is therefore not required. The consent described in section 4 applies separately to transfer of a raw voice recording.
Optional nearby search with Geoapify
When you consent and start nearby search, our backend sends the search position rounded to four decimal places, or your entered address, plus category and language to Geoapify / KEPTAGO LTD as processor. We exclusively use api-eu.geoapify.com. Geoapify finds up to 20 public places within 200 m and a street label for the search position. Manual addresses are first resolved into positions for you to choose. Your account identifier, profile and Circle content are not forwarded; the provider connection comes from our backend, not your device IP. The legal basis is consent under Art. 6(1)(a) GDPR. Device location is accessed only on your action and with device permission; alternatively, enter an address.
Geoapify normally retains detailed personal API request data for no more than 24 hours. In exceptional cases, including suspicious or fraudulent activity, individual request details may be retained for analysis for up to two months. This is not Zero Data Retention. The incorporated Geoapify standard DPA applies, including its subprocessors for the EU connection. Geoapify DPA
We hold the search position, address and results temporarily for the current flow only, not in search histories or technical logs. This feature creates no location history or profile and does not use location for advertising or background monitoring. Leaving or withdrawing clears the transient search state. Only a place you deliberately select and then save becomes part of your content, not your original search location. Authentication and usage limits internally use your account identifier under Art. 6(1)(b) GDPR, with no location in the counters.
Your consent is stored locally on this device with account identifier, version and time, without location. Withdraw anytime under ⓘ and optionally revoke device permission. The local record is removed or replaced on withdrawal, account deletion on the device or consent by another account. Withdrawal applies to future requests and does not affect prior lawful processing. Existing OpenAI search consent is not reused for Geoapify; the provider change requires a new choice. Regular place search remains independently available.
Explore nearby on the map
Map-based Explore nearby requires separate consent. Only when you tap do we send the chosen map centre, rounded to four decimal places, categories and language through our backend to the existing Geoapify EU service. We retrieve up to 20 public places within 500 m straight-line distance, not a guaranteed walking route. Moving the map makes no request. Your account identifier, profile and private content are not forwarded to Geoapify. The basis is your voluntary consent under Art. 6(1)(a) GDPR. The Geoapify retention periods and recipients described above apply.
If you then use Ask, the confirmed search is repeated with Geoapify to verify the selected place identifiers. Selected public venue facts may be processed with your question in the existing Ask AI flow; existing AI consent remains required. Public venue data is identified as such, not presented as personal recommendations. Discovery alone does not generate AI tags, save a place or share anything.
The search area and results stay only in memory and are discarded on ×, leaving the map or changing accounts. Separately, consent is saved on this device with only the account and version identifiers until reset, account deletion or replacement by another account consent. Reset it under Account or Settings in your profile; the next search will ask again. Searches never start automatically. No location history or search position is stored in logs or usage limits. Only explicit saving or recommending adds a venue to your content, where correction, deletion and export remain available. Withdrawal does not affect prior lawful processing. Add’s 200 m search remains independent.
Notice for older app versions with AI search
Optional AI area discovery
If you voluntarily consent to AI place search and start Discover places, we send your position rounded to three decimal places or the area you enter, optional category and language through our backend to OpenAI for web search for public cafés, restaurants, bars and bakeries. Location is requested only after Use my location and device permission. Alternatively, enter an area. The legal basis is your consent under Art. 6(1)(a) GDPR. Your account identifier, profile and private Circle content are not sent to the AI. CircleRecs internally processes your account identifier for authentication and usage limits under Art. 6(1)(b) GDPR.
Requests use the approved OpenAI EU connection with effective Zero Data Retention for request content. Web search may involve OpenAI search providers; further recipient information appears below. Search location and request content are not stored in our technical logs. Inputs and results remain in memory only for the current flow and are discarded when you leave. This feature creates no location history, background access, tracking or profiling. You can withdraw consent in the search panel and revoke device permission to prevent further location queries. This does not affect processing lawfully performed before withdrawal.
Only when you select a suggestion do we use its public venue name and address for the existing place lookup. You check the correct place, can edit the draft and choose whether to save it and who can see it. Regular place search remains independently available. If you open a source link, the external website's own privacy notice applies.
To avoid asking again for each search, we remember your consent locally on this device with your account identifier, notice version and timestamp. This record contains no location and is not sent to OpenAI. It remains until you withdraw through the nearby search info button, delete your account on this device, or replace it by consenting for another account. We ask again when the described data flow changes.
Licensed venue photographs
Where member photographs are absent, we may display a licensed venue photograph from Wikimedia Commons. Our server looks up public venue identifiers through Geoapify (EU), OpenStreetMap via overpass-api.de and, where needed, Wikidata/Wikimedia Commons. These services receive the server IP and requested public identifiers, not your account identifier, device IP, notes or GPS position. Wikimedia may process outside the EEA. Images are served from our AWS storage; your browser connects to an external source only when you open a source link. We keep no personal history of your image requests.
If no usable direct image reference is available, our server may also search Wikimedia Commons using the public venue name and city from Geoapify. On our server, we compare published image coordinates or unambiguous venue and address evidence with public provider data. A provider-linked venue category may also serve as a source when the exact address is established, or for artworks when the complete subject name and published image coordinates match. Your GPS position is not transmitted for this. Ambiguous matches are not used.
We store the optimized image, a small thumbnail and author, source and license credits separately from member uploads. Credits are accessible alongside the image. Stored images are scheduled for revalidation when requested again after 90 days. Incorrect or challenged images can be blocked and deleted from our storage; copies already loaded on devices cannot be recalled. Contact support@circlerecs.com with the venue or source link. An external image does not imply a member's visit or authorship.
We may also manually curate individually reviewed, openly licensed Flickr photographs. Only public photo and attribution information is checked; no member data is sent to Flickr. Flickr may process outside the EEA. These images are also served from our AWS storage, without contacting Flickr when a venue is opened. Manually curated images follow documented individual review and the same blocking and deletion process.
© OpenStreetMap contributors · ODbL · Powered by Geoapify · Wikimedia Commons
Google venue photos: limited iOS pilot
For individually enabled test accounts and public venues, the iOS app may load Google Places UI Kit when the detail view opens and owned media is absent. Google receives the public place identifier and connection and technical SDK data directly from the device, such as its IP address and a technical device identifier. We do not send your CircleRecs account identifier, notes, contacts, search questions or GPS position for this feature. Lists, map pins and app startup do not load this component.
If a verified Google place identifier is missing, our server may match the public venue name, address and venue coordinates with Google Places when such a detail view opens. These are catalogue facts, not your device location or private notes. Uncertain matches are not used. We retain the matched place identifier and our own comparison data; additional Google response fields are processed only during matching.
Google photos and attribution remain in a separate Google component. CircleRecs does not store these photos on its servers or add them to member galleries or semantic search. We store the verified place-ID mapping and account-free quota counters, not a personal history of your photo requests. Pilot access can be revoked and expires automatically. Contact support@circlerecs.com to leave the pilot or report an incorrect place match. Google may process data outside the EEA; its privacy policy provides further information.
Trends: matching public venues
For Trends, we research public venues using OpenAI web search based on a city and, where relevant, a category. Free text filters existing results and is not sent to research in this workflow. To match a venue, our server may send its independently researched public name, city, country and, if available, address to Google Places. We do not send account identifiers, private recommendations, notes or device locations for this matching.
Public research results are reused for up to 30 days. We store the Google place identifier separately from a temporary coordinate copy. That copy becomes invalid in the active system within 21 days and is regularly deleted; retention including time-limited backups is less than 30 days. Coordinates may be refreshed when the venue is used again. Your saved venue relationship remains separate. Other Google response fields are processed only during matching; durable catalogue names, addresses and descriptions come from independent sources. Google may process data outside the EEA. Report incorrect matches or deletion requests to support@circlerecs.com.
6. Google data
Google sign-in and Google Maps list import are separate features. List import starts only when you explicitly paste a public Google Maps list link. We then fetch the publicly available list data to show you editable place suggestions. The providers described in sections 5 and 9 may be used for this purpose. No Google sign-in is required for this import. You review and confirm what is saved before it is stored.
Import candidates remain private. Unselected candidates are not semantically indexed for circle search and are deleted no later than 30 days later. Only if you later publish a place as your own recommendation is your CircleRecs content processed as described in section 5. You can remove stored import data in the app, ask supportto remove it, or delete your CircleRecs account.
We use information from Google APIs and from public Google Maps lists you paste only for the described visible sign-in, import and enabled venue-photo features. We do not sell it, use it for advertising, or use it to train general-purpose AI models. Human access is allowed only when you explicitly request support, where needed for security, or where required by law. Where we use Google APIs, our use and transfer adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing of Google user data. We do not share, transfer, or disclose the data we receive through Google APIs or through a public list link you paste, including imported collections, places, links, and notes as well as Google sign-in data, to any third party, and we do not sell it, except: (a) to our service providers acting on our instructions solely to process, host, and secure this data on our behalf, namely Amazon Web Services (storage and database), Vercel (delivery of the web frontend), and OpenAI (category and tag suggestions you start); (b) when you explicitly consent to the sharing; (c) where strictly necessary to detect, prevent, or address security, fraud, or technical issues; or (d) where required by law or necessary to protect legal claims. We do not share this data with advertising, analytics, or data-broker services, and we do not use it to train general-purpose AI models. If you later explicitly publish an imported place as your own recommendation, the resulting CircleRecs content is processed as described in section 5.
Protection of your data, including sensitive data. Data is transmitted only over encrypted connections (TLS/HTTPS). Data at rest is stored on access-restricted infrastructure with encryption at rest. Access to Google user data is limited to legitimate purposes on a least-privilege basis and is controlled and logged. Import candidates remain private until you explicitly publish them. You can remove import data in the import area of the app, ask support to remove it, or delete your CircleRecs account.
7. Import from public social-media links
Through the iOS share sheet, you can send CircleRecs a public Instagram, TikTok, or YouTube post. We may process the public link, platform, text or caption supplied by the share sheet, and publicly available preview data (title, creator name, cover) to suggest a place. CircleRecs does not sign in to your social-media account or access private content.
We reduce link parameters to the required public post address. Shared text may be sent to OpenAI to prepare editable place suggestions. A caption does not automatically become your personal recommendation. Temporary share-extension files are removed after handoff or discard. Only places and media you confirm are stored with the visibility you choose. If you confirm the post is yours and choose to show it on the recommendation, we store the public link and the creator name you confirmed; the cover may then be stored as your recommendation photo. We do not store another creator's name or image as yours. Share only content you are entitled to use.
8. Affiliate and booking links
Some recommendations may contain booking links to partners, for example GetYourGuide. These links are advertising: if you complete a booking through them, Axel Springer Deutschland GmbH may receive a commission. This does not create any additional cost for you. We label such links accordingly in the app.
When you open such a link, CircleRecs may add a pseudonymous attribution code to the destination. We use this code only internally to attribute a resulting booking to the recommendation and circle that prompted it and to award community points. The code does not contain clear names readable by third parties. The legal basis is our legitimate interest in funding and gamifying the service under Art. 6(1)(f) GDPR.
After the click you leave CircleRecs and are on the partner's website. The partner is independently responsible for the processing that takes place there and may set its own cookies and process data under its own privacy policy. We do not set our own advertising or tracking cookies in your browser for these purposes.
To improve activation, reliability, and retention, CircleRecs processes limited, account-linked first-party product data. This includes no more than one active-day record per platform, the app version, and categorised actions such as opening a place detail, push notification, or Ask source, or sharing an invitation. These events contain no search text, message content, location coordinates, or place, recommendation, or Circle identifiers. The legal basis is our legitimate interest in developing a useful and stable service under Art. 6(1)(f) GDPR. We use no analytics cookies, persistent analytics local storage, cross-app advertising tracking, or third-party analytics SDK for this purpose. You may object on grounds relating to your particular situation.
Invitation openings additionally use a random identifier to associate a possible signup and join or follow. This handoff is used in the browser tab or on the device for at most 24 hours. Our server retains the time, platform, invitation type and associated account and Circle identifiers for at most 30 days. Access tokens, search text and device fingerprints are excluded. Account-free totals remain for measurement. Access and objection requests can be sent to our privacy contact.
9. Recipients and transfers
Depending on your visibility settings, other circle members, followers, or internet users receive access to content intended for them. Our technical providers are Amazon Web Services for sign-in, databases, storage, live features, email, and logs; Vercel for the web frontend; Google for sign-in, the public Google Maps list import you start and the enabled iOS venue-photo component; Apple for sign-in, App Store purchases and subscription status, MapKit and Apple Maps, native speech recognition, and push delivery; OpenFreeMap for map styles and tiles; the Nominatim service on openstreetmap.org and Geoapify for place searches and matching; OpenAI for AI, embeddings, transcription, and place classification; Pinecone for semantic search; Dash0 for technical observability; and Hostinger for the support mailbox. MapLibre GL runs as a local software library and does not itself receive user data. Place data from the Overture Maps Foundation is imported into our own catalogue; search queries are not sent to Overture. OpenAI is also used for the web search for public place information that you start. We may disclose data to authorities or other bodies where legally required or necessary to protect legal claims.
Where creators participate in the payout programme, only authorised product, legal, tax, and finance teams within the Axel Springer organisation receive the information needed for that purpose. Banks and, where legally required, tax authorities may receive payout data. Apple acts independently under its own privacy terms when processing App Store purchases.
Some providers may process data outside the European Economic Area. Where a third-country transfer occurs, we rely, depending on the recipient, on an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, or appropriate safeguards under Art. 46 GDPR, in particular EU Standard Contractual Clauses and any necessary supplementary measures. You can obtain information about the safeguards used from the data protection officer.
10. Retention and deletion
We delete waitlist entries when you withdraw or no later than 12 months after signup unless you accept an invitation and create an account. Browser data ends with the session or the storage period stated above. Technical logs are generally retained for 30 days. Database backups expire after seven days unless longer retention is legally required.
Product analytics events and unselected Google import candidates are deleted no later than 30 days later. To count unique monthly users, only the activity month is kept per account and platform until month end plus at most two days (33 days maximum); account deletion removes this membership. Cohort statistics derived from them contain no user or content identifier and remain only as aggregate metrics. Technical AI place-search hints may be cached for up to six hours. Temporary social-share files are removed after handoff or discard. Affiliate attribution is deleted no later than 90 days later. Raw voice recordings are processed only for the relevant transcription request and then discarded.
Product data remains stored while your account is active or while required for the service, misuse prevention, legal defence, or legal obligations. You can delete individual content and your account in the app. Account deletion removes associated active product data, media, Google import data, and semantic search documents; remaining backup copies expire according to the backup schedule. We retain reports and moderation communication only as long as necessary for review, legal defence, and legal obligations.
Deleting your CircleRecs account does not cancel an Apple subscription. We delete or detach the active account association, while minimised transaction and payout records may be kept for Apple notifications, refunds, misuse prevention, legal claims, and statutory accounting and retention duties. They are deleted or anonymised when those purposes end. You can manage and cancel the subscription separately in your Apple Account.
11. Avoid unnecessary sensitive data
Please do not enter unnecessary sensitive data in free text or voice input, or upload confidential information about other people in photos or videos. Before sharing, check that people shown or mentioned agree and that you are allowed to use the content.
12. Your data protection rights
Subject to the legal requirements, you have, in particular, the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent with effect for the future. To exercise your rights, contact datenschutz@axelspringer.com and use “CircleRecs – Betroffenenrechte” as the subject. You also have the right to lodge a complaint with a data protection supervisory authority.
The competent authority is, in particular, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, email mailbox@datenschutz-berlin.de.
You are not legally required to provide data. Without an email address, we cannot add you to the waitlist; without a supported Apple or Google account, we cannot create a CircleRecs account; and without confirming the minimum age, we cannot provide the service. We require a display name for your profile. Your age, profile image, and all other profile, place, and content information are optional.
Network-based account suggestions
We use public follow connections within CircleRecs to suggest relevant public accounts. If you follow X and X follows Y, Y may be suggested. Public recommendations and search cities you select help establish relevance. We do not use private or inaccessible relationships, private Circle content, GPS, address books or external social networks for this purpose. Reasons such as ‘Followed by X’ use only public relationships visible at the time of retrieval.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is improving relevant account suggestions within the existing service; a balancing assessment has been completed. Processing takes place only in our existing backend infrastructure with AWS as processor. We do not send these connections to AI or advertising services, use them for advertising, or make decisions with legal or similarly significant effects. Network copies, ranking scores and suggestion reasons are not stored permanently.
Turn off network suggestions under Discover → From your network → Settings. Your follow connections will then no longer be used for your personalised suggestions; regular search remains available. For hidden network suggestions, we store only your account ID and the hidden account ID for as long as necessary to honour your choice. This suppression data is deleted when you reset hidden suggestions, either relevant account is deleted, or the purpose no longer applies. Your right to object under Art. 21 GDPR remains unaffected. Contact the privacy contact above for access, export or further objections.
Private cities for creator suggestions
Under “Tips for …”, choose up to five cities or “Everywhere”. We store this setting with your account ID in our existing AWS database, not in your public profile. It is used only to order creator suggestions by your preferred cities. You can change it anytime; “Everywhere” removes saved city names and disables automatic location context. The setting is deleted with your account. Contact the privacy contact above for access or export.
Without an explicit city selection, or with “Current city”, previously granted location access can determine your current city once. iOS uses Apple geocoding; Web uses the existing place lookup through our backend. Without permission or if lookup fails, discovery remains worldwide. Automatically inferred cities stay in the session; we store neither GPS coordinates nor location history. A city you explicitly confirm can be saved as a preference. There is no background tracking or transfer of the setting to AI or advertising services. Saved preferences serve the function you request; location access requires your revocable system permission.
Optional prize draw
Entry is free, voluntary, age 18+ and requires explicit registration. Before joining, you separately accept that round's rules. Signing in alone does not enter you. No purchase or subscription is required. A private profile is made public only after separate confirmation.
For one entry, all three goals must be met at the deadline: 10 different positive public place recommendations in the same city, following 5 different accounts, and membership in a free Circle with at least 4 active members including you. Your profile and recommendations must be public. Existing activity counts. You need not have created the Circle; other accounts need not enter. Blocked contacts and people who object to processing are excluded. Private places and messages are not evaluated.
One entry per person; no multiple accounts. More activity adds no entries and there is no points leaderboard. Regular community points are unchanged. The first DE/VN cash round is only for people ordinarily resident in Germany or Vietnam. At least 100 valid entrants across both countries combined are required. Below that, no draw or prizes. At 100 or more, three different winners are selected randomly, each receiving the economic value of EUR 100. An explicitly labelled test round remains without payout. The specific rules and dates show whether and when a round is open; this general description does not activate a round.
The rules and dates displayed before registration for the specific round apply. Before a cash round opens, the organizer, eligible territory, any exclusions, and contact, response and payout deadlines must be specified. Available languages do not imply worldwide eligibility. Apple does not sponsor or administer the draw.
Accepting the rules is not consent to advertising. The basis for limited eligibility checks is described in the privacy notice below. There is no public participant leaderboard. You can leave without removing your content, contacts or regular points. An authenticated export of your participation data is available.
Eligibility checks
To verify eligibility, we may process, to a limited extent, account data visible publicly or within the platform about people who do not enter the giveaway, particularly relevant followed accounts or Circle members.
Processing is solely for eligibility verification and proper operation of the giveaway, based on our legitimate interest under Article 6(1)(f) GDPR. The data is not used for advertising or published in connection with the giveaway, and is processed only as long as necessary to verify eligibility.
Our privacy policy includes further information about the controller, data subject rights and how to object: Privacy policy.
We store registration, rules version and limited progress counts, not contact or member lists. The DE/VN round also records the rules content hash, declared country of ordinary residence and necessary winner, contact and processing status. Leaving and account deletion remove participation. Earlier v1 rounds are still deleted within six hours of their published expiry. For the DE/VN round, necessary operational data is retained until winner checks, any replacement draws and payment are completed; data no longer needed is then deleted by the cleanup process. Legally required financial, tax and legal records are retained separately and only for those purposes. No advertising use. Objections, access and other privacy rights: support@circlerecs.com or datenschutz@axelspringer.com.
Archive: earlier points challenge, not the rules of this draw